Phi 235 social media security users guide presentation
Download as PPTX, PDF1 like1,409 views
The document provides an overview of various cyber security solutions and concepts. It discusses 13 sections related to cyber security including access control solutions, vulnerability analysis, gap analysis, penetration testing, web application security, log analysis, network traffic analysis, information security policy design, and security products identification. Each section provides 1-3 paragraphs explaining the topic and key considerations.
Ad
More Related Content
What's hot (20)
Viewers also liked (10)
Ad
Similar to Phi 235 social media security users guide presentation (20)
Ad
Recently uploaded (20)
Phi 235 social media security users guide presentation
- 1. SOCIAL MEDIA SECURITY USERS GUIDE CYBER SECURITY SOLUTIONS ALAN HOLYOKE PHI 235
- 3. WEBSITES SECURITY As you can see by the diagram to the left, there are numerous browsers and websites that you and I utilize on a daily basis, an ever growing reality that keeps us โconnectedโ to everyone and everything that we may want to be connected to. In regards to Cyber Security Solutions, this guide will explain the thirteen different sections covering everything from Access Control to Gap Analysis to Information Security Policy and everything in between. Well, letโs take a journey, shall weโฆ.
- 4. Access control solutions Access control solutions allow companies to determine who can go where and when. An audit trail shows the details of who passed through your access control entry and exit devices. Events recorded to a head end computer may be linked to video, paging, or alarm functions. By combining software and hardware, your system can be controlled, queried, or programmed from anywhere on your network or via a secure web browser.
- 5. They give you a complete picture of each employees activity by days, weeks, and the times they passed though any access controlled door in your facility. Your records will show whether they passed through during your regular working hours or off hours. Our access systems are based on time tested, user friendly software and allow for monitoring and control in remote sites throughout your existing network. Access control solutions (continued)
- 6. Vulnerability analysis Vulnerability analysis, also known as vulnerability assessment, is a process that defines, identifies, and classifies the security holes (vulnerabilities) in a computer, network, or communications infrastructure. In addition, vulnerability analysis can forecast the effectiveness of proposed countermeasures and evaluate their actual effectiveness after they are put into use.
- 7. Vulnerability analysis (continued) Vulnerability analysis consists of several steps: ๏ Defining and classifying network or system resources ๏ Assigning relative levels of importance to the resources ๏ Identifying potential threats to each resource ๏ Developing a strategy to deal with the most serious potential problems first ๏ Defining and implementing ways to minimize the consequences if an attack occurs.
- 8. Vulnerability analysis (continued) If security holes are found as a result of vulnerability analysis, a vulnerability disclosure may be required. The person or organization that discovers the vulnerability, or a responsible industry body such as the Computer Emergency Readiness Team (CERT), may make the disclosure. If the vulnerability is not classified as a high level threat, the vendor may be given a certain amount of time to fix the problem before the vulnerability is disclosed publicly.
- 9. Vulnerability analysis (continued) The third stage of vulnerability analysis (identifying potential threats) is sometimes performed by a white hat using ethical hacking techniques. Using this method to assess vulnerabilities, security experts deliberately probe a network or system to discover its weaknesses. This process provides guidelines for the development of countermeasures to prevent a genuine attack.
- 10. gap analysis A technique that businesses use to determine what steps need to be taken in order to move from its current state to its desired, future state. Also called need-gap analysis, needs analysis, and needs assessment.
- 11. gap analysis (continued) ๏ถ Listing of characteristic factors (such as attributes, competencies, performance levels) of the present situation ("what is") ๏ถ Listing factors needed to achieve future objectives ("what should be"), and then ๏ถ Highlighting the gaps that exist and need to be filled. Gap analysis forces a company to reflect on who it is and ask who they want to be in the future.
- 12. Penetration testing A penetration test is a proactive and authorized attempt to evaluate the security of an IT infrastructure. This is done by safely attempting to exploit system vulnerabilities such as: โข The Operating System (OS) โข Service and Application flaws โข Improper Configurations โข Validating the Efficiency of Defensive Mechanisms Such assessments are also useful in validating the efficiency of end-usersโ adherence to company security policies.
- 13. Penetration testing (continued) A penetration test is a test whose results validate the risk posed by specific security vulnerabilities or flawed processes. This enables IT management and security professionals to prioritize remediation efforts. By embracing more frequent and comprehensive penetration testing, organizations can more effectively anticipate emerging security risks and prevent unauthorized access to critical systems and valuable information.
- 14. Web application security Web Application Security is an internet security audit, performed by experienced security professionals. A key feature of the service, and one which cannot be covered by relying solely on automated testing, is application testing. The service is designed to rigorously push the defenses of internet networks and applications.
- 15. Web application security (continued) It is suitable for commissioning, third party assurance, post-attack analysis, audit and regulatory purposes where independence and quality of service are important requirements. A final written report provides an analysis of any security or service problems discovered together with proposed solutions, links to detailed advisories and recommendations for improving the security of the service under test. The Web Application Testing service can be used to ensure compliance with PCI DSS v2.0 requirement 11.3, (penetration testing) as it includes both network and application layer testing.
- 16. Web application security (continued) Areas Covered by Web Application Testing ๏ฑ Configuration errors ๏ฑ Application loopholes in server code or scripts ๏ฑ Advice on data that could have been exposed due to past errors ๏ฑ Testing for known vulnerabilities ๏ฑ Reducing the risk and enticement to attack ๏ฑ Advice on fixes and future security plans
- 17. Web application security (continued) Typical Issues Discovered in an Application Test o Cross-site scripting o SQL injection o Server misconfigurations o Form/hidden field manipulation o Command injection o Cookie poisoning o Well-known platform vulnerabilities o Insecure use of cryptography
- 18. Web application security (continued) Typical Issues Discovered in an Application Test (continued) o Back doors and debug options o Errors triggering sensitive information leak o Broken ACLs/Weak passwords o Weak session management o Buffer overflows o Forceful browsing o CGI-BIN manipulation o Risk reduction to zero day exploits
- 19. Log analysis Log Analysis lets you analyze unstructured data to help identify, isolate and resolve problems. The software integrates data from multiple sources including logs, events, metrics, support documents and trouble tickets.
- 20. Network traffic analysis Network analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network. This is accomplished by two different monitoring techniques: ๏ผ Router Based โ Monitoring functionalities that are built into the routers themselves & do not require and additional installation of hardware or software. ๏ผ Non-Router Based - Monitoring techniques require additional hardware and software to be installed and provide greater flexibility.
- 21. Information security Policy design The first step to creating an effective information security policy is evaluating information assets and identifying threats to those assets. Some assets within an organization will be more valuable than others, but monetary value should not be the only factor. Determining both the monetary value and the intrinsic value of an asset is essential in accurately gauging its worth.
- 22. Information security Policy design (continued) To calculate an assetโs monetary value: An organization should consider the impact if that assetโs data, networks or systems are compromised in any way. To calculate an assetโs intrinsic value: An organization must consider a security incidentโs impact on credibility, reputation and relationships with key stakeholders.
- 23. Information security Policy design (continued) When assessing potential threats, external and internal threats must be considered. External threats include viruses, worms, Trojan horses, hacking attempts and anything that tries to break an organizationโs security infrastructure from the OUTSIDE. Internal threats include abuse of critical systems and data, surfing objectionable Internet content, and inappropriate Internet use. The real costly danger with internal threats comes from perpetrators having extensive access to the network from the INSIDE.
- 24. Information security Policy design (continued) Since an information security policy will have an effect on people throughout the organization, a team should take the responsibility for drafting the policy together. This team should include executives, IT administrators, information security experts, human resource managers, public relations managers, legal counsel and IT auditors. Approval for the policy should come from the highest possible level in the corporate environment.
- 25. Security products identification There are several security products on the market. Here is a list of a few of those security products: Passport Laminates Passport laminates range from a clear film overlay to Covid holographic and Fasver printed security laminates, featuring overt, covert, and forensic security devices. All laminates are custom designed to suit the document and the application equipment.
- 26. Security products identification (continued) ID Card Laminates Covid holographic and Fasver printed security laminates protect ID cards against forgery and counterfeit attempts. Most companies will work with each client to create custom originations that integrate with the background artwork and personalized data to deliver cohesive designs that are attractive, original, easy to authenticate, and highly secure.
- 27. Security products identification (continued) Polycarbonate Solutions Polycarbonate solutions provide security both in and on identity documents and enable color personalization on ID cards. Fasver printed security layers can be embedded within polycarbonate cards and passport data pages to help authenticate genuine ID documents and prevent counterfeiting. Covid holographic patches add security to the cardโs surface while protecting the Unichroma-enabled color personalized data.
- 28. Security products identification (continued) Seals, Labels, and Hot Stamp Foils Our seals, labels, and hot stamp foils are used by governments worldwide to protect signatures on official documents, and to secure and authenticate document pouches and vehicle stickers. Card Personalization Imagedata D2T2 ribbons generate vibrant colors and high-definition print for photos, background imagery, text, and bar codes, making them ideal for the personalization of secure and non-secure ID cards.
- 29. Cyber security surveys Forty-seven percent of surveyed organizations have suffered a cyber-attack in the past year โ and a frightening 13 percent say they do not even know if they have been attacked. These are among the results of the 2013 Cyber Security Study conducted by Information Security Media Group and commissioned by Bit9.
- 30. Data leak prevention solutions Data leak prevention solution is a system that is designed to detect potential data breach or data ex-filtration transmissions and prevent them. It does this by monitoring, detecting and blocking sensitive data while in-use (endpoint actions), in-motion (network traffic), and at-rest (data storage). In data leakage incidents, sensitive data is disclosed to unauthorized personnel either by malicious intent or by an inadvertent mistake. Such sensitive data can come in the form of private or company information, intellectual property (IP), financial or patient information, credit-card data, and other information depending on the business and the industry.
- 31. Cyber hygiene Cyber hygiene refers to steps that computer users can take to improve their cybersecurity and better protect themselves online.
- 32. Cyber hygiene (continued) The best practices are not new technologies, but fairly common sense ideas that need to become part of an enterprise culture. The common practices are listed below: โข Eliminate unnecessary data and keep tabs on what is left; โข Ensure essential controls are met and regularly audit to in order consistent implementation; โข Change default credentials; โข Avoid shared credentials; โข Implement a firewall or access control list (ACL) on remote access/administration services; โข Utilize IP blacklisting;
- 33. Cyber hygiene (continued) The common practices are continued below: โข Update anti-virus and other software consistently; โข Audit user accounts; โข Restrict and monitor privileged users; โข Monitor and filter outbound network traffic; โข Test applications and review codes; โข Change the approach to event monitoring and log analysis; โข Define โsuspiciousโ and โanomalousโ (then look for whatever โitโ is); โข Increase awareness of social engineering; โข Train employees and customers to look for signs tampering and fraud;
- 34. Cyber investigation A cyber investigation investigates those offences that are committed against individuals or groups of individuals with a criminal motive to intentionally harm the reputation of the victim or cause physical or mental harm to the victim directly or indirectly, using modern telecommunication networks such as Internet (Chat rooms, emails, notice boards and groups) and mobile phones (SMS/MMS).
- 35. Information security policy Information security policy is a set of policies issued by an organization to ensure that all information technology users within the domain of the organization or its networks comply with rules and guidelines related to the security of the information stored digitally at any point in the network or within the organization's boundaries of authority.
- 36. Comprehensive cyber security solution Government agencies need to proactively protect their critical applications, data and processes from external and internal threats throughout their entire life cycle. By taking a comprehensive and integrated approach to application vulnerability management, agencies can measurably improve operational security, mitigate risks, and reduce costs.
- 39. Computing with the โCloudโ Most people when they here the word โcloudโ they think of the clouds in the sky, that would be only logical. But from a computing standpoint, the โCloudโ is simply a technology that uses the Internet and remote servers to: ๏ Maintain data and applications ๏ Allows users to access applications without installation . ๏ Allows users access to their personal files from any computer that has access to the Internet. ๏ Centralizes storage, memory, processing, and bandwidth.In regards to your Yahoo email account, that software is managed by Yahoo. Your Gmail account software is managed by Google.
- 40. HTTPS (HYPERTEXT TRANSFER PROTOCOL SECURE) โข Install HTTPS Everywhere on your Web browser. โข HTTPS Everywhere is a Firefox, Chrome, and Opera extension that encrypts any communication that you may have with major websites. โข More specifically, this extension encrypts your Web browsing sessions, protecting you from hackers and spy agencies that scoop up unencrypted traffic across the Internet. http://www.youtube.com/watch?v=8nRlsaWfo30